Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-41949 |
high | 8.2 | 0.0043 | 2026-11-08 | Dify before version 1.14.2 contains an authorization bypass vulnerability in the file prev | |
CVE-2026-41948 |
critical | 9.3 | 0.2271 | 2026-11-08 | Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authentic | |
CVE-2026-41947 |
critical | 9.3 | 0.0597 | 2026-11-08 | Dify before version 1.14.2 contains an authorization bypass vulnerability that allows auth | |
CVE-2026-41456 |
medium | 5.1 | 0.0354 | 2026-11-08 | 1 PoC | Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability |
CVE-2026-41455 |
medium | 6.3 | 0.0024 | 2026-11-08 | WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integrat | |
CVE-2026-41454 |
high | 8.7 | 0.0027 | 2026-11-08 | WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST A | |
CVE-2026-41451 |
high | 8.5 | 0.0117 | 2026-11-08 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vu | |
CVE-2026-41450 |
high | 8.5 | 0.0114 | 2026-11-08 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vu | |
CVE-2026-41449 |
high | 8.5 | 0.0103 | 2026-11-08 | UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vu | |
CVE-2026-41448 |
critical | 9.2 | 0.0054 | 2026-11-08 | AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulne | |
CVE-2026-40519 |
high | 7.7 | 0.0092 | 2026-11-08 | Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an au | |
CVE-2026-40510 |
low | 1.0 | 0.0029 | 2026-11-08 | OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulner | |
CVE-2026-40506 |
high | 7.0 | 0.0070 | 2026-11-08 | OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage | |
CVE-2026-40036 |
high | 8.7 | 0.0052 | 2026-11-08 | Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_comp | |
CVE-2026-40035 |
critical | 9.3 | 0.0057 | 2026-11-08 | Unfurl through 2025.08 contains an improper input validation vulnerability in config parsi | |
CVE-2026-40034 |
high | 7.3 | 0.0065 | 2026-11-08 | gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly valida | |
CVE-2026-40033 |
high | 8.6 | 0.0137 | 2026-11-08 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface | |
CVE-2026-40032 |
high | 8.5 | 0.0074 | 2026-11-08 | UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerab | |
CVE-2026-40031 |
high | 8.5 | 0.0014 | 2026-11-08 | MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL an | |
CVE-2026-40028 |
medium | 5.1 | 0.0021 | 2026-11-08 | Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its | |
CVE-2026-40027 |
high | 8.4 | 0.0019 | 2026-11-08 | ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal v | |
CVE-2026-40026 |
medium | 4.8 | 0.0014 | 2026-11-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 | |
CVE-2026-40025 |
medium | 4.8 | 0.0013 | 2026-11-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS fil | |
CVE-2026-39922 |
medium | 5.3 | 0.0018 | 2026-11-08 | GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a se | |
CVE-2026-39921 |
medium | 5.3 | 0.0023 | 2026-11-08 | GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forge | |
CVE-2026-35016 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35015 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35014 |
medium | 5.1 | 0.0023 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35013 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35012 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35011 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35010 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35009 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35008 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35007 |
medium | 5.1 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-35002 |
critical | 9.3 | 0.0086 | 2026-11-08 | Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the mod | |
CVE-2026-34966 |
high | 8.3 | 0.0039 | 2026-11-08 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows aut | |
CVE-2026-34963 |
high | 8.6 | 0.0015 | 2026-11-08 | barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the | |
CVE-2026-34962 |
medium | 6.9 | 0.0013 | 2026-11-08 | barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 dire | |
CVE-2026-34961 |
medium | 6.9 | 0.0021 | 2026-11-08 | barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 ext | |
CVE-2026-34960 |
high | 7.1 | 0.0025 | 2026-11-08 | barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP op | |
CVE-2026-34426 |
medium | 6.9 | 0.0027 | 2026-11-08 | OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to | |
CVE-2026-34425 |
medium | 5.3 | 0.0032 | 2026-11-08 | OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerabil | |
CVE-2026-34411 |
medium | 6.9 | 0.0040 | 2026-11-08 | Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without | |
CVE-2026-32984 |
medium | 5.3 | 0.0031 | 2026-11-08 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause m | |
CVE-2026-32857 |
high | 7.8 | 0.0043 | 2026-11-08 | Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection | |
CVE-2026-32854 |
medium | 6.3 | 0.0553 | 2026-11-08 | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dere | |
CVE-2026-32853 |
medium | 6.9 | 0.0046 | 2026-11-08 | LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bou | |
CVE-2026-32846 |
high | 8.7 | 0.0072 | 2026-11-08 | OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that al | |
CVE-2026-32845 |
medium | 6.9 | 0.0014 | 2026-11-08 | cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_valida |